A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00165.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Redhat Subscribe
Apicurio Registry Subscribe
Build Keycloak Subscribe
Camel Quarkus Subscribe
Debezium Subscribe
Exploit Intelligence Subscribe
Jboss Fuse Subscribe
Openshift Ai Subscribe
Openshift Devspaces Subscribe
Quarkus Subscribe
Serverless Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/security/cve/CVE-2026-107912 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2548364 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-107912 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-107912 cve-icon
History

Fri, 06 Nov 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 05 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 05 Nov 2026 13:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied to the wrong internal paths. As a result, an attacker can bypass intended authorization checks and gain unauthorized access to sensitive management endpoints.
Title Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
First Time appeared Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat exploit Intelligence
Redhat jboss Fuse
Redhat openshift Ai
Redhat openshift Devspaces
Redhat quarkus
Redhat serverless
Weaknesses CWE-862
CPEs cpe:/a:redhat:apicurio_registry:3
cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_quarkus:3
cpe:/a:redhat:debezium:3
cpe:/a:redhat:exploit_intelligence:0
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:openshift_ai
cpe:/a:redhat:openshift_devspaces:3
cpe:/a:redhat:quarkus:3
cpe:/a:redhat:serverless:1
Vendors & Products Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat exploit Intelligence
Redhat jboss Fuse
Redhat openshift Ai
Redhat openshift Devspaces
Redhat quarkus
Redhat serverless
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-05T16:30:14.324Z

Reserved: 2026-10-09T05:00:24.359Z

Link: CVE-2026-107912

cve-icon Vulnrichment

Updated: 2026-11-05T16:29:52.746Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-05T14:16:59.697

Modified: 2026-11-05T17:17:35.427

Link: CVE-2026-107912

cve-icon Redhat

Severity : Important

Publid Date: 2026-11-05T12:34:20Z

Links: CVE-2026-107912 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T14:30:08Z

Weaknesses